{"id":7,"date":"2018-12-21T11:41:00","date_gmt":"2018-12-21T02:41:00","guid":{"rendered":"https:\/\/www.picolix.jp\/blog\/2018\/12\/openssl-111a-tls-13-smail-tls-13.html\/"},"modified":"2019-04-02T10:31:44","modified_gmt":"2019-04-02T01:31:44","slug":"openssl-111a-tls-13-smail-tls-13","status":"publish","type":"post","link":"https:\/\/www.picolix.jp\/blog\/2018\/12\/openssl-111a-tls-13-smail-tls-13.html","title":{"rendered":"openssl-1.1.1a TLS 1.3\u30b5\u30dd\u30fc\u30c8 \/ SMAIL TLS 1.3\u30b5\u30dd\u30fc\u30c8\u4e88\u5b9a"},"content":{"rendered":"

2018\/09\/11\u306bOpenSSL 1.1.1\u304c\u30ea\u30ea\u30fc\u30b9\u3055\u308cTLS v1.3\u304c\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u307e\u3057\u305f\u3002
\n\u6700\u65b0\u30d0\u30fc\u30b8\u30e7\u30f3\u306f\u30012018\/11\/20 OpenSSL 1.1.1a\u3067\u30011.02\u7cfb\u306fOpenSSL 1.0.2q\u3068\u306a\u308a\u307e\u3059\u3002<\/p>\n

SMAIL v4.20<\/a>\u306f\u3001OpenSSL 1.0.2\u7cfb\u3092\u4f7f\u3063\u3066\u3044\u307e\u3059\u306e\u3067\u3001TLS\u306fv1.2\u307e\u3067\u3067\u3001\u4eca\u56de
\nOpenSSL 1.1.1a\u3092\u4f7f\u3063\u3066\u3001TLS v1.3\u3067\u30e1\u30fc\u30eb\u901a\u4fe1\u3067\u304d\u308b\u304b\u8a66\u3057\u307e\u3057\u305f\u3002\uff08\u5b89\u5b9a\u52d5\u4f5c\u78ba\u8a8d\u5f8c\u3001v4.21\u3092\u30ea\u30ea\u30fc\u30b9\u3059\u308b\u4e88\u5b9a\u3067\u3059\u3002\uff09<\/p>\n

\uff11\uff0eOpenSSL 1.1.1a\u306e\u30b3\u30f3\u30d1\u30a4\u30eb<\/b>
\n  1) https:\/\/www.openssl.org\/source\/<\/a>\u3000\u3088\u308a\u3001openssl-1.1.1a.tar.gz\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9
\n  2) \u30b3\u30f3\u30d1\u30a4\u30eb\u74b0\u5883\u306e\u5b9f\u884c\uff08Visual Studio 10.0\uff09
\n     C:workvcfreeopenssl-1.1.1a>”C:Program Files (x86)Microsoft Visual Studio 10.0VCbinvcvars32.bat”
\n     Setting environment for using Microsoft Visual Studio 2010 x86 tools.
\n  3) Configure\u306e\u5b9f\u884c
\n     C:workvcfreeopenssl-1.1.1a>perl Configure VC-WIN32 no-asm enable-tls1_3 –prefix=C:workvcfreeopenssl-1.1.1a<\/p>\n

     \u203b\u30fb64BIT\u306e\u6642\u306f\u3001VC-WIN32\u306e\u4ee3\u308f\u308a\u306bVC-WIN64A
\n\u3000\u3000  \u30fbasembler\u3067\u30b3\u30f3\u30d1\u30a4\u30eb\u51fa\u6765\u308b\u3068\u304d\u306f\u3001no-asm\u306f\u5916\u3057\u3066\u4e0b\u3055\u3044\u3002SHA\u7b49\u306e\u8a08\u7b97\u306f\u304c\u65e9\u304f\u306a\u308b\u3002
\n\u3000\u3000  \u30fbtls1.3\u3092\u4f7f\u3046\u306e\u3067\u3001enable-tls1_3<\/p>\n

\u3000\u3000\u3000Configuring OpenSSL version 1.1.1a (0x1010101fL) for VC-WIN32
\n\u3000\u3000\u3000Using os-specific seed configuration
\n\u3000\u3000\u3000Set up gcc environment – 3.4.5 (mingw-vista special r3)
\n\u3000\u3000\u3000Creating configdata.pm
\n\u3000\u3000\u3000Creating makefile<\/p>\n

**********************************************************************
\n***                                                                ***
\n***   OpenSSL has been successfully configured                     ***
\n***                                                                ***
\n***   If you encounter a problem while building, please open an    ***
\n***   issue on GitHub <https:\/\/github.com\/openssl\/openssl\/issues>  ***
\n***   and include the output from the following command:           ***
\n***                                                                ***
\n***       perl configdata.pm –dump                                ***
\n***                                                                ***
\n***   (If you are new to OpenSSL, you might want to consult the    ***
\n***   ‘Troubleshooting’ section in the INSTALL file first)         ***
\n***                                                                ***
\n**********************************************************************
\n\u3000\u3000\u3000C:workvcfreeopenssl-1.1.1a><\/p>\n

    \u203bOpenSSL 1.0.2\u7cfb\u306e\u6642\u306f\u3001ms\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30fc\u304c\u751f\u6210\u3055\u308c\u3066\u305d\u306e\u914d\u4e0b\u306b
\n\u3000\u3000\u3000nt.mak\u3068\u304bntdll.mak\u304c\u4f5c\u3089\u308c\u3066\u3044\u307e\u3057\u305f\u304c\u3001\u5fc5\u8981\u306a\u304f\u306a\u308a\u307e\u3057\u305f\u3002
\n\u3000
\n\u30004) makefile\u306e\u66f8\u304d\u63db\u3048
\n     smail\u306f\u3001\u30de\u30eb\u30c1\u30b9\u30ec\u30c3\u30c9 \u30d0\u30fc\u30b8\u30e7\u30f3\u306e\u9759\u7684\u306a\u30e9\u30f3\u30bf\u30a4\u30e0\u30e9\u30a4\u30d6\u30e9\u30ea\u3092\u4f7f\u7528\u3059\u308b\u305f\u3081
\n\u3000   \u30b3\u30f3\u30d1\u30a4\u30eb\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u5909\u66f4\u3057\u307e\u3059\u3002<\/p>\n

\u3000\u3000\u3000CNF_CFLAGS=\/Gs0 \/GF \/Gy \/MD
\n\u3000\u3000\u3000=>
\n\u3000\u3000\u3000CNF_CFLAGS=\/Gs0 \/GF \/Gy \/MT
\n\u3000\u3000\u3000\u306b\u5909\u66f4<\/p>\n

\u30005) \u30b3\u30f3\u30d1\u30a4\u30eb
\n     C:workvcfreeopenssl-1.1.1a>nmake
\n     libcrypto.def
\n     libssl.def
\n     libcrypto.lib
\n     libssl.lib
\n     libcrypto_static.lib
\n     libssl_static.lib
\n     \u304c\u751f\u6210\u3055\u308c\u308b\u3002\u5fc5\u8981\u306a\u306e\u306flibcrypto.def,libssl.def,libcrypto_static.lib,libssl_static.lib<\/p>\n

\n\uff12.smail\u306e\u30b3\u30f3\u30d1\u30a4\u30eb\uff08\u30bd\u30fc\u30b9\u30b3\u30fc\u30c9\u306f\u975e\u516c\u958b\u3067\u3059\u3002\uff09\u5909\u66f4\u70b9\u306e\u307f\u30e1\u30e2<\/b><\/p>\n

\u3000\u30001)\u30ea\u30f3\u30af\u30e9\u30a4\u30d6\u30e9\u30ea\u30fc\u306e\u5909\u66f4
\n \u3000\u3000libeay32.lib;ssleay32.lib
\n \u3000\u3000\uff1d\uff1e
\n \u3000\u3000libcrypto_static.lib;libssl_static.lib<\/p>\n

    2)\u8ffd\u52a0\u3067\u5fc5\u8981\u306a\u30e9\u30a4\u30d6\u30e9\u30ea\u30fc
\n\u3000\u3000 ws2_32.lib
\n 
\n     \u203b\u3053\u308c\u3092\u30ea\u30f3\u30af\u3057\u306a\u3044\u3068\u3001
\n\u3000\u3000\u3000__imp__freeaddrinfo
\n\u3000\u3000\u3000__imp__getnameinfo
\n\u3000\u3000\u3000__imp__getaddrinfo
\n\u3000\u3000\u3000\u304cunresolved external symbol\u3068\u306a\u308a\u307e\u3059\u3002<\/p>\n

\u3000\u3000\u3053\u308c\u3060\u3051\u3067\u3001\uff2f\uff2b\u3002<\/p>\n

\n\uff13\uff0etls 1.3\u5bfe\u5fdc\u306e\u30e1\u30fc\u30eb\u30b5\u30fc\u30d0\u3092\u7528\u610f<\/b><\/p>\n

\u3000\u3000tls 1.3\u5bfe\u5fdc\u306e\u30e1\u30fc\u30eb\u30b5\u30fc\u30d0\u304c\u306a\u3044\u3068\u3001tls 1.3\u3067\u901a\u4fe1\u3067\u304d\u308b\u304b\u3069\u3046\u304b
\n\u3000\u3000\u308f\u304b\u3089\u306a\u3044\u306e\u3067\u3001tls 1.3\u5bfe\u5fdc\u306e\u30e1\u30fc\u30eb\u30b5\u30fc\u30d0\u3092\u6e96\u5099\u3002
\n\u3000\u3000https:\/\/qiita.com\/ma3ki\/items\/3e40775e74bad58a06f3<\/a>
\n\u3000\u3000\u3092\u53c2\u8003\u306b\u3001www.picolix.jp\u306b\u30bb\u30c3\u30c8\u30a2\u30c3\u30d7\u3002\uff08\u4ed6\u304b\u3089\u306f\u5229\u7528\u3067\u304d\u307e\u305b\u3093\u3002\uff09
\n\u3000\u3000\u518d\u8a18\u3057\u3066\u304a\u304d\u307e\u3059\u3002
\n\u3000\u3000
\n\u3000\u30001) openssl-1.1.1 \u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb
\n   # curl -O -L https:\/\/www.openssl.org\/source\/openssl-1.1.1.tar.gz
\n   # tar xvzf openssl-1.1.1.tar.gz
\n   # cd openssl-1.1.1
\n   # .\/config –prefix=\/usr\/local\/openssl-1.1.1 shared zlib
\n   # make
\n   # make install<\/p>\n

   # echo \/usr\/local\/openssl-1.1.1\/lib >> \/etc\/ld.so.conf.d\/openssl.conf
\n   # ldconfig<\/p>\n

   2) postfix-3.3.1 \u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb
\n    # cp -p \/usr\/lib\/systemd\/system\/postfix.service \/var\/tmp
\n    # yum remove -y postfix
\n    # curl -O http:\/\/www.ftp.saix.net\/MTA\/postfix\/official\/postfix-3.3.1.tar.gz
\n    # tar xvzf postfix-3.3.1.tar.gz
\n    # cd postfix-3.3.1
\n    # CCARGS=”-Wmissing-prototypes -Wformat -Wno-comment -fPIC
\n-DHAS_LDAP -DLDAP_DEPRECATED=1 -DHAS_PCRE -I\/usr\/include\/pcre
\n-DHAS_MYSQL -I\/usr\/include\/mysql -DUSE_SASL_AUTH -DUSE_CYRUS_SASL
\n-I\/usr\/include\/sasl -DUSE_TLS -I\/usr\/local\/openssl-1.1.1\/include
\n-DDEF_CONFIG_DIR=”\/etc\/postfix””
\n# AUXLIBS=”-lldap -llber -lpcre -L\/usr\/lib64\/mysql -lmysqlclient
\n-lm -L\/usr\/lib64\/sasl2 -lsasl2 -L\/usr\/local\/openssl-1.1.1\/lib -lssl
\n-lcrypto  -pie -Wl,-z,relro,-z,now”
\n# make -f Makefile.init makefiles CCARGS=”${CCARGS}” AUXLIBS=”${AUXLIBS}”
\n# make
\n# make install
\n* \u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u5148\u306f\u5168\u3066\u30c7\u30d5\u30a9\u30eb\u30c8<\/p>\n

  3) SSL\u8a3c\u660e\u66f8\u306e\u53d6\u5f97
\n     www.picolix.jp letsencrypt\u3067\u81ea\u52d5\u53d6\u5f97\u3057\u3066\u3044\u308b\u306e\u3067\u5272\u611b<\/p>\n

\u30004) postfix \u306b SSL\/TLS\u95a2\u9023\u8a2d\u5b9a\u3092\u8ffd\u52a0\u3057\u3066\u8d77\u52d5<\/p>\n

# cat <<_EOL_>> \/etc\/postfix\/main.cf
\nsmtp_tls_CAfile = \/etc\/pki\/tls\/certs\/ca-bundle.crt
\nsmtp_tls_cert_file = \/opt\/dehydrated\/certs\/www.picolix.jp\/fullchain.pem
\nsmtp_tls_key_file  = \/opt\/dehydrated\/certs\/www.picolix.jp\/privkey.pem
\nsmtp_tls_loglevel = 1
\nsmtp_tls_security_level = may
\nsmtp_use_tls =yes
\nsmtpd_tls_CAfile = \/etc\/pki\/tls\/certs\/ca-bundle.crt
\nsmtpd_tls_ask_ccert = yes
\nsmtpd_tls_cert_file = \/opt\/dehydrated\/certs\/www.picolix.jp\/fullchain.pem
\nsmtpd_tls_ciphers = high
\nsmtpd_tls_key_file  = \/opt\/dehydrated\/certs\/www.picolix.jp\/privkey.pem
\nsmtpd_tls_loglevel = 1
\nsmtpd_tls_mandatory_ciphers = high
\nsmtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
\nsmtpd_tls_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
\nsmtpd_tls_received_header = yes
\nsmtpd_tls_session_cache_database = btree:\/var\/lib\/postfix\/smtpd_tls_session_cache
\nsmtpd_use_tls = yes
\ntls_high_cipherlist  = EECDH+AESGCM
\ntls_preempt_cipherlist = yes
\n_EOL_<\/p>\n

   Postfix\u306f\u3001\u4e2d\u9593\u8a3c\u660e\u66f8\u3092\u8a2d\u5b9a\u3059\u308b\u9805\u76ee\u304c\u306a\u3044\u306e\u3067\u3001\u8a3c\u660e\u66f8\u3068\u4e2d\u9593\u8a3c\u660e\u66f8\u306e\u4e21\u65b9\u304c\u542b\u307e\u308c\u308bfullchain.pem \u3092\u6307\u5b9a\u3057\u307e\u3059\u3002<\/p>\n

# cp -p \/var\/tmp\/postfix.service \/usr\/lib\/systemd\/system\/
\n# systemctl enable postfix
\n# systemctl start postfix
\n# postconf -e “alias_maps = hash:\/etc\/aliases”<\/p>\n

\uff14\uff0esmail\u52d5\u4f5c\u78ba\u8a8d<\/b>
\n\u3000\uff33\uff33\uff2c\u6697\u53f7\u5316\u306f\u3001\u8a2d\u5b9a\u4e0aSSLv2\/v3\u3092\u9078\u629e\u3002\uff08\u81ea\u52d5\u3067sslv2,v3,tls 1,1.1,1.2,1.3\u304c\u9069\u5fdc\u3055\u308c\u307e\u3059\u3002TLS\u3092\u9078\u629e\u3057\u305f\u5834\u5408\u306ftls1.0\u56fa\u5b9a\u3000\u3053\u306e\u3042\u305f\u308a\u306f\u6587\u8a00\u4fee\u6b63\u4e88\u5b9a\uff09<\/p>\n

\n<\/a><\/div>\n

<\/p>\n

\n<\/a><\/div>\n

\n\u3000\u30b5\u30fc\u30d0\u5074\u306e\u30ed\u30b0
\n\u3000\uff1d\uff1d
\nDec 21 20:16:27 www postfix\/smtpd[11397]: Anonymous TLS connection established from xx.xxx.xx[xx.xx.xx.xx]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256\/256 bits)
\n\u3000\uff1d\uff1d<\/p>\n

  TLS 1.3\u3067\u901a\u4fe1\u3067\u304d\u3066\u3044\u308b\u3053\u3068\u3092\u78ba\u8a8d\u3002
\n  \u5f53\u521dtls 1.3\u7528\u306eclient_method\u306e\u95a2\u6570\u304c\u306a\u304fconnection\u306e\u65b9\u6cd5\u3092\u5909\u3048\u306a\u3044\u3068\u3044\u3051\u306a\u3044\u306e\u304b\u3068\u601d\u3044\u307e\u3057\u305f\u304c\u3001\u52dd\u624b\u306b\u3000tls 1.3\u304c\u5fc5\u8981\u306a\u6642\u306f\u3001tls 1.3\u3067\u901a\u4fe1\u3067\u304d\u307e\u3057\u305f\u3002
\n\uff08smail \u8fd1\u65e5\u30d0\u30fc\u30b8\u30e7\u30f3\u30a2\u30c3\u30d7\u4e88\u5b9a\u3067\u3059\u3002)<\/p>\n","protected":false},"excerpt":{"rendered":"

2018\/09\/11\u306bOpenSSL 1.1.1\u304c\u30ea\u30ea\u30fc\u30b9\u3055\u308cTLS v1.3\u304c\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u307e\u3057\u305f\u3002 \u6700\u65b0\u30d0\u30fc\u30b8\u30e7\u30f3\u306f\u30012018\/11\/20 OpenSSL 1.1.1a\u3067\u30011.02\u7cfb\u306fOpenSSL 1.0.2q\u3068\u306a\u308a … <\/p>\n

“openssl-1.1.1a TLS 1.3\u30b5\u30dd\u30fc\u30c8 \/ SMAIL TLS 1.3\u30b5\u30dd\u30fc\u30c8\u4e88\u5b9a” \u306e<\/span>\u7d9a\u304d\u3092\u8aad\u3080<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[6],"_links":{"self":[{"href":"https:\/\/www.picolix.jp\/blog\/wp-json\/wp\/v2\/posts\/7"}],"collection":[{"href":"https:\/\/www.picolix.jp\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.picolix.jp\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.picolix.jp\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.picolix.jp\/blog\/wp-json\/wp\/v2\/comments?post=7"}],"version-history":[{"count":1,"href":"https:\/\/www.picolix.jp\/blog\/wp-json\/wp\/v2\/posts\/7\/revisions"}],"predecessor-version":[{"id":1643,"href":"https:\/\/www.picolix.jp\/blog\/wp-json\/wp\/v2\/posts\/7\/revisions\/1643"}],"wp:attachment":[{"href":"https:\/\/www.picolix.jp\/blog\/wp-json\/wp\/v2\/media?parent=7"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.picolix.jp\/blog\/wp-json\/wp\/v2\/categories?post=7"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.picolix.jp\/blog\/wp-json\/wp\/v2\/tags?post=7"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}